build(deps): bump js-yaml from 4.2.0 to 5.2.0 by dependabot[bot] · Pull Request #635 · slackapi/slack-github-action

dependabot · 2026-07-01T05:03:08Z

Bumps js-yaml from 4.2.0 to 5.2.0.

Changelog

[5.2.0] - 2026-06-26

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

[breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

Added named exports for schemas, tags, parser events and AST utilities.

Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.

Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.

Added dump() transform option for changing the generated AST before rendering.

Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.

Added formal data layers (events and AST) for modular data pipelines.

Added low-level parser (to events), presenter and visitor APIs.

Added the YAML Test Suite to the test set.

Changed

See the migration guide for upgrade notes.

Rewritten in TypeScript and reorganized the public API around flat named exports.

Reduced the set of exported schemas:

YAML 1.2 schemas: CORE_SCHEMA (loader default), JSON_SCHEMA, FAILSAFE_SCHEMA.

YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not specify a schema, only "types").

... (truncated)

Commits

c28ed5e 5.2.0 released
125cd5a Add maxAliases option
3105455 Replace maxMergeSeqLengthoption with maxTotalMergeKeys (more robust)
39d00d6 numbers: Drop boxed numbers support, simplify .identify() checks, clarify rou...
eb5cb5b fix: round-trip integers that stringify in exponential notation (#771)
89024c4 Update migration info, close #770
f1e45cd 5.1.0 released
53b22be Fix constructor coverage
a1eaa2b Fix quote style options and restore forceQuotes
0532e7d Add finalizers for immutable collection tags
Additional commits viewable in compare view

changeset-bot · 2026-07-01T05:03:12Z

⚠️ No Changeset found

Latest commit: db8217b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 5.2.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...5.2.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

codecov · 2026-07-08T21:20:42Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.86%. Comparing base (10c95c6) to head (db8217b).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #635   +/-   ##
=======================================
  Coverage   99.86%   99.86%           
=======================================
  Files           7        7           
  Lines         736      736           
=======================================
  Hits          735      735           
  Misses          1        1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

js-yaml v5 removes the default export and ships its own types. Switch src/content.js to named imports ({ JSON_SCHEMA, load }) and drop the now-redundant @types/js-yaml dev dependency. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

zimeg

@dependabot LGTM! A few migration changes but nothing so breaking:

🔗 https://github.com/nodeca/js-yaml/blob/master/docs/migrate_v4_to_v5.md

zimeg · 2026-07-09T19:01:10Z

    "@biomejs/biome": "^2.5.1",
    "@changesets/cli": "^2.31.0",
    "@types/flat": "^5.0.5",
-    "@types/js-yaml": "^4.0.9",


🫡 praise: Farewell separate @types/js-yaml package and thank you!

js-yaml 5.x adopts strict YAML 1.2 flow-scalar indentation and throws `deficient indentation` on a double-quoted value that wraps across a blank line onto a column-0 continuation line. A `payload: |` block strips its common indent, so keys and wrapped values land at column 0 -- the exact shape of a multi-paragraph Slack message. Payloads that worked in v3.0.3 broke in v3.0.4 (#635). 5.x offers no option or schema to relax this (CORE_SCHEMA, YAML11_SCHEMA and the default all throw identically), so revert js-yaml to ^4.2.0 and restore the @types/js-yaml devDependency. This makes the regression test added in the previous commit pass. Fixes #637 Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 1, 2026

dependabot Bot requested a review from a team as a code owner July 1, 2026 05:03

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 1, 2026

dependabot Bot had a problem deploying to staging July 1, 2026 05:03 Failure

dependabot Bot temporarily deployed to staging July 1, 2026 05:03 Inactive

dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-5.2.0 branch from 2f8900d to 7401bd2 Compare July 1, 2026 05:05

dependabot Bot temporarily deployed to staging July 1, 2026 05:05 Inactive

dependabot Bot had a problem deploying to staging July 1, 2026 05:05 Failure

dependabot Bot temporarily deployed to staging July 1, 2026 05:05 Inactive

zimeg temporarily deployed to staging July 8, 2026 21:20 — with GitHub Actions Inactive

build: migrate to js-yaml v5 named exports

db8217b

js-yaml v5 removes the default export and ships its own types. Switch src/content.js to named imports ({ JSON_SCHEMA, load }) and drop the now-redundant @types/js-yaml dev dependency. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

zimeg force-pushed the dependabot/npm_and_yarn/js-yaml-5.2.0 branch from 6b4610d to db8217b Compare July 9, 2026 19:00

zimeg temporarily deployed to staging July 9, 2026 19:00 — with GitHub Actions Inactive

zimeg approved these changes Jul 9, 2026

View reviewed changes

zimeg merged commit 0539f0d into main Jul 9, 2026
13 checks passed

zimeg deleted the dependabot/npm_and_yarn/js-yaml-5.2.0 branch July 9, 2026 19:03

AviVahl mentioned this pull request Jul 10, 2026

[3.0.4][Regression] SlackError: Invalid input! Failed to parse contents of the provided payload #637

Closed

zimeg mentioned this pull request Jul 11, 2026

fix: revert multiline yaml parsing indentation change #638

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump js-yaml from 4.2.0 to 5.2.0#635

build(deps): bump js-yaml from 4.2.0 to 5.2.0#635
zimeg merged 2 commits into
mainfrom
dependabot/npm_and_yarn/js-yaml-5.2.0

dependabot Bot commented on behalf of github Jul 1, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

zimeg left a comment

Uh oh!

zimeg Jul 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[5.2.0] - 2026-06-26

Added

Removed

Fixed

[5.1.0] - 2026-06-23

Added

Changed

[5.0.0] - 2026-06-20

Added

Changed

Uh oh!

changeset-bot Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

codecov Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zimeg left a comment

Choose a reason for hiding this comment

Uh oh!

zimeg Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 1, 2026 •

edited

Loading

changeset-bot Bot commented Jul 1, 2026 •

edited

Loading

codecov Bot commented Jul 8, 2026 •

edited

Loading